Hey guys,
I have a Lumia 800 with a "messed up" Qualcomm bootloader. Here's what's different about it:
- Power+Vol.UP button combination doesn't work. Every other combination works great (FTM, Hard Reset, etc.).
- Since that combination doesn't work, I can't get to OSBL mode without NSSPro.
- When in OSBL mode, it shows up as Qualcomm CDMA Technologies MSM on Windows, OS X and Ubuntu but doesn't show its NAND partitions.
- In the Device Manager on Windows, the device has a tiny yellow warning sign like it's not working properly or it doesn't have the correct drivers. I tried installing/uninstalling the Qualcomm drivers from the other thread but nothing changed.
Is there any way to "repair"/reset the bootloader or force it to show its partitions ? Obviously I'm very careful with it so it doesn't get replaced with a DLOAD one.
I can put the USB debug logs from any/all of the OS if it might help.
Please help if you have any idea. Thanks.
I have tried all kinds of things on Windows.
I tried forcing the generic USB Mass Storage Device driver but it said it couldn't "start" the device.
I also installed all kinds of Qualcomm drivers I could find. I found the correct one, Qualcomm HS-Diagnostics 9006 (COMx), though unsigned (and still showing the yellow warning sign). Lumia still doesn't show the partitions.
Installed QPST (had weird errors about not being able to register a lot of DLLs while installing) and the Lumia didn't even appear in the devices list. (might be because of the broken install, I don't know)
Any ideas ?
inket said:
I have tried all kinds of things on Windows.
I tried forcing the generic USB Mass Storage Device driver but it said it couldn't "start" the device.
I also installed all kinds of Qualcomm drivers I could find. I found the correct one, Qualcomm HS-Diagnostics 9006 (COMx), though unsigned (and still showing the yellow warning sign). Lumia still doesn't show the partitions.
Installed QPST (had weird errors about not being able to register a lot of DLLs while installing) and the Lumia didn't even appear in the devices list. (might be because of the broken install, I don't know)
Any ideas ?
Click to expand...
Click to collapse
Mine does the same thing... My guess is that it is a intermediate version between full dev qualcomm bootloader and nokia dload that they rushed out.
What's your phone info?
My Lumia's information (weird bootloader):
Firmware: 12070
Hardware revison: 112.1402.2.3
Radio SW version: 1.6.00.24
Radio HW version: 8255
Bootloader version: 7.35.0.0
Chip SOC version: 0.74.2.1
ROM Language: 0C0A (Spanish (Spain))
ROM version: 7.0.8107.0
OEM Device Name: RM-801 EU 238
Mobile Operator: 000-ES
IMEI: 35928904 67xxxxx
Friend's (Nokia DLOAD):
Firmware: 12070
Hardware revison: 112.1402.2.3
Radio SW version: 1.6.00.24
Radio HW version: 8255
Bootloader version: 7.35.0.0
Chip SOC version: 0.74.2.1
ROM Language: 0809 (English (United Kingdom))
ROM version: 7.0.8107.0
OEM Device Name: RM-801 EU NDT EURO1
Mobile Operator: 000-33
IMEI: 35928904 79xxxxx
I have thought to open the phone and remove the battery to see if it helps, but I haven't tried it yet.
At least, I'm not the only one.
Here's mine:
OS: 7.10.8107.79
Firmware: 1600.2489.8107.12072
Hardware revision: 112.1402.2.3
Radio SW version: 1.6.00.24
Radio HW version: 8255
Bootloader version: 7.35.0.0
Chip SOC version: 0.74.2.1
IMEI: 3592890464xxxxx
Product Code: 059L702
Basic Product Code: 059J2N6
Type Designator: RM-801
Production SN (PSN): 004370FAB (< copied this because it seemed interesting)
That's all I found on WP, NCS and NSSPro. Where did you find the other info ?
I know that mine came from Vodafone Spain and 11414 firmware. Interesting, right ? Both from Spain.
My phone is the Unlocked Spanish country version, came with 11412.
I got the information from the diagnostics app (dial ##634#). I don't know if the diagnostics from 12072 has all this data (it should), I haven't updated mine from 11500.
Where did you get the PSN?
The question is: it is related to the country variant or to the production run?
I found the PSN on both NSSPro and NCS. Look in the Extended Info in NCS, I think.
My Lumia's info from Diagnostics:
ROM Language: 0C0A (doesn't say "(Spanish(Spain))" or anything, just 0C0A)
ROM version: 7.0.8107.0
OEM Device Name: RM-801 EU 214
Mobile Operator: VOD-ES
So far the only similarity is that they're both from Spain.
Nothing new, I guess ?
I'm thinking of trying NCS' "Refurbish" or "Recovery".
Anyone care to explain how do they work or what do they do exactly ?
I still don't want to replace the bootloader with Nokia's; I'm looking if there's a way to "refresh" the bootloader or something like that.
just take the battery out and insert after 10 or more second..then press and hold the vol up and insert the usb cable while holding vol up ....usb should be connected to pc from other end...after u inserted usb in phone u feel a short vibration, then leave the vol button and u'll be in qpst mode..
@debbuger
Are you sure that would work ?
I mean, did you have the same problem and you fixed it by removing the battery ?
sorry bro i thought that u've lumia 710.. don't remove battery do as follows --
as u r on l800
force it off by pressing the power switch for about 10 to 15 sec ,
then press and hold vol up and insert the usb ..a short vibratin means u r in osbl mode...
Already tried that. Doesn't work. Thanks anyway.
can u tell me if ur lumia is shipped with qualcom boot or you have flashed it after ...
It shipped that way.
Can you post the USB ID of the phone in bootloader mode? (lsusb -n in Linux, or Details tab in the Windows device manager)
Oh my brothers lumia 710 was given for a repair ang was returned with dload
Sent from my MB865 using xda premium
lsusb:
Bus 001 Device 002: ID 05c6:9006 Qualcomm, Inc.
Ubuntu's lsusb doesn't have the option '-n' so I'll paste the verbose output:
Code:
Bus 001 Device 002: ID 05c6:9006 Qualcomm, Inc.
Couldn't open device, some information will be missing
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x05c6 Qualcomm, Inc.
idProduct 0x9006
bcdDevice 0.00
iManufacturer 3
iProduct 2
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1
bmAttributes 0xe0
Self Powered
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Seems like your phone is going into QHSUSB_DLOAD mode, whenever you try to use bootloader mode. Also, you get "Couldn't open device", which sounds like a hardware issue. Take it to the repair shop.
One thing to try is plug in the phone normally into your computer (while in Linux), and turning it on. Post the device IDs that show up in "dmesg" after doing that.
Thanks NetRoller.
.NetRolller 3D said:
Seems like your phone is going into QHSUSB_DLOAD mode, whenever you try to use bootloader mode.
Click to expand...
Click to collapse
What's QHSUSB_DLOAD mode ? I looked all over the internet and found nothing answering that...
Please note that this mode isn't triggered with the Power+VolUp combination, but by selecting OSBL Mode in NSSPro. I don't know much about this but maybe selecting other modes in NSSPro could be more "useful" ?
.NetRolller 3D said:
Also, you get "Couldn't open device", which sounds like a hardware issue. Take it to the repair shop.
Click to expand...
Click to collapse
I just realized, the "Couldn't open device" is because I ran lsusb as a user (without sudo)... I'll try it again and paste the output.
.NetRolller 3D said:
One thing to try is plug in the phone normally into your computer (while in Linux), and turning it on. Post the device IDs that show up in "dmesg" after doing that.
Click to expand...
Click to collapse
Doesn't seem to have anything important (I added comments):
Code:
[345141.576034] usb 1-6: new high-speed USB device number 3 using ehci_hcd
[345142.410405] generic-usb 0003:045E:041E.0001: hiddev0,hidraw0: USB HID v1.10 Device [Microsoft Windows Phone] on usb-0000:00:1d.7-6/input0
[345142.410441] usbcore: registered new interface driver usbhid
[345142.410445] usbhid: USB HID core driver
# vibration
# screen ON but black, stays like that for 15s
[345157.617055] usb 1-6: USB disconnect, device number 3
# shuts down
# vibration
# boots
[345178.864037] usb 1-6: new high-speed USB device number 4 using ehci_hcd
Does Power+VolUP put it into "mass storage" mode?
Power+VolUp does nothing. Long vibration and it just boots normally. Here's the `sudo lsusb -v` after switching to "OSBL Mode" through NSSPro:
Code:
Bus 001 Device 005: ID 05c6:9006 Qualcomm, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x05c6 Qualcomm, Inc.
idProduct 0x9006
bcdDevice 0.00
iManufacturer 3 Qualcomm, Incorporated
iProduct 2 Qualcomm CDMA Technologies MSM
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1 Qualcomm Configuration
bmAttributes 0xe0
Self Powered
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
Hi,
Need some help please.
Unlocked bootloader. Jellybean P769 V20F.
CWM is installed from what i can see from below.
:\Users\rj\Desktop\L769\fastboot\fastboot\yours>fastboot devices
09145AF61202200E fastboot
C:\Users\rj\Desktop\L769\fastboot\fastboot\yours>cd c:\android
c:\Android>fastboot flash recovery recovery-clockwork-touch-6.0.3.1-p760.img
sending 'recovery' (5898 KB)...
OKAY [ 3.036s]
writing 'recovery'...
OKAY [ 1.019s]
finished. total time: 4.063s
But i cannot get int recovery by pressing the key cominbation vol up+home+pwer. Phone just reboots
Thanks much!
ADB reboot recovery
So it tried adb reboot recovery. Boots into recovery. But the screen is upside down. I need to use a mirror to read the commands on the screen properly.
Interestingly screen is normal in regular mode
Touch is working.
Still wondering why key combination to boot into recovery is not working.??????
Thanks:fingers-crossed:
thankyouxda said:
Hi,
Need some help please.
Click to expand...
Click to collapse
Install busybox
Sent from my Nexus 7 using xda premium
you flashed the p760 recovery, you need the p769
http://forum.xda-developers.com/showpost.php?p=44300426&postcount=358
the key combination for twrp at boot is vol (-) + home + power (release power when lg logo appears)
the key combination for cwm is either vol up or down + plus the other two.
Another thing, fix the inverted lg logo (that's if you haven't done so already)
http://forum.xda-developers.com/showpost.php?p=44161955&postcount=310
Hi Kuma82,Thank you.
I'll try the 769 recovery you linked.and report.
Re: inverted logo. This is to fix Inverted logo in fastboot correct?, I do see inverted logo when i fastboot otherwise not.
Thanks!
---------------------------------------------------------------------------------------------------------------------------
Also jezus. Thanks for busybox suggestion. installed but didn't help in this case so far.
kuma82 said:
you flashed the p760 recovery, you need the p769
Another thing, fix the inverted lg logo (that's if you haven't done so already)
http://forum.xda-developers.com/showpost.php?p=44161955&postcount=310
Click to expand...
Click to collapse
Fastboot is suppose to be inverted. You must already be on the 20f u-boot, you don't need that zip.
CM 10.1 P769
1)Installled CWM and now the screen is not mirrored anymore. Thanks
Key combination to boot into recovery still not working. Phone gets to LG then splash screen comes and then shuts off.
ADB reboot recovery works though. Any ideas about why keycombo not working? Not sure if it is worth the time
2)TWRP installed. Works great. Key combination works. Guess i will keep TWRP
Thanks!
kuma82 said:
Fastboot is suppose to be inverted. You must already be on the 20f u-boot, you don't need that zip.
CM 10.1 P769
Click to expand...
Click to collapse
thankyouxda said:
1)Installled CWM and now the screen is not mirrored anymore. Thanks
Key combination to boot into recovery still not working. Phone gets to LG then splash screen comes and then shuts off.
ADB reboot recovery works though. Any ideas about why keycombo not working? Not sure if it is worth the time
2)TWRP installed. Works great. Key combination works. Guess i will keep TWRP
Thanks!
Click to expand...
Click to collapse
key combination o]n 20f uboot is "vol-" and "home"
never mind
Hellooo Lelus :laugh:
Thanks for dropping by. U have made life easier for a lot of L9 users.:good:
Respect!!
Lelus said:
key combination o]n 20f uboot is "vol-" and "home"
never mind
Click to expand...
Click to collapse
thankyouxda said:
Hi,
Need some help please.
Unlocked bootloader. Jellybean P769 V20F.
!
Click to expand...
Click to collapse
Hi! I am new to unlocking bootloaders. Can you pllease tell me how you unlocked your bootloader?
Hi.
Need some help please.
Sorry for my english, but don't say good English and writing by google translator.
I am new to the forum, but I've read tens of posts.
He writes here, because I have a similar problem.
I have a LG L9 P769 phone purchased in the USA. My soft it: T-Mobile V20f.kdz
For several days'm trying to install the Bootloader & CWM Recovery. But I can't run it.
I decided so to install TWRP, the same as "thankyouxda", because I can see that at him he is acting.
But after the installation and the restart I receive the LG screen with the Security Error.
I recovered the phone with UpTestEX_BY_BRIDE_ 2014 program, but still I don't have Bootloader & CWM Recovery.
What am I doing wrong?!
Any program that installs Recovery at normal operating your phone and waiting for 50 minutes for me does not work. Everyone is only restarting my phone.
Only this method applies:
I run phone C/W Update (Vol Up + plug USB cable). I install the drivers and I type this command:
Code:
Plug USB cable
wait 4 seconds and put battery back in.
waiting for OMAP44xx device...
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
reading ASIC ID
usb_write 4
usb_read 81[*] read 0 bytes
NumOfSubblocks: 0x5
Subblock ID: 0x1
Subblock Size: 0x5
CH enabled: 0x7
ROM revision: 0x4
Checksum Subblock: 0x15
CHIP: 4430
IDEN: 9ed4cae7db55647eff3ed3cc853e28ece762f077
MPKH: 5f4092eccddf90fa43f546adf89508b31b9c74795e9516194c0ea6412fdcb7f6
CRC0: 9c669ad9
CRC1: 682adccf
sending 2ndstage to target... f0030002
usb_write 4
usb_write 4
wait 5-lelelel...
[*] msg size = 4
usb_write 21552[*] data size = 21552
usb_close
Reopen usb...
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
waiting for 2ndstage response...
usb_read 4
usb read = aabbccdd
accepted 2ndstage response
sending image to target...
size = 246272
usb_write 4
usb_write 246272
** Done **
Microsoft Windows [Wersja 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Wszelkie prawa zastrzeżone.
C:\fastboot\yours>
I have a mirror screen LG.
Now he is writing the command:
Code:
C:\fastboot\yours>fastboot devices
014FBECB02002010 fastboot
C:\fastboot\yours>fastboot flash recovery recovery.img
sending 'recovery' (6786 KB)...
OKAY [ 3.536s]
writing 'recovery'...
OKAY [ 1.756s]
finished. total time: 5.292s
C:\fastboot\yours>
But CWM does not start, any combination of the phone keys. I tried to install different cwm.img
So I downloaded the TWRP-769.zip, unpacked, moved twrp.img file to the directory of fastboot and I type:
Code:
C:\fastboot\yours>fastboot flash recovery twrp.img
.......
I'm sorry, but I did with this copy, but it looks like the CWM and writes OKEY, finished ...
It seemed, however, that everything went well. But the installed file is probably too large (10 240 kB)!?
Other CWM.img that I tried to install took only 6 500 - 6 900 kB.
What am I doing wrong that after reboot the phone getting the LG Security Error?
1) Should I install busyboox at first?
2) Should I install 20f_u-boot.zip first, to the mirror screen LG? How does it install?
3) What is the META-INF directory, and if it is needed for installation twrp.img?
Very much please help me.
thankyouxda said:
1)Installled CWM and now the screen is not mirrored anymore. Thanks
Key combination to boot into recovery still not working. Phone gets to LG then splash screen comes and then shuts off.
ADB reboot recovery works though. Any ideas about why keycombo not working? Not sure if it is worth the time
2)TWRP installed. Works great. Key combination works. Guess i will keep TWRP
Thanks!
Click to expand...
Click to collapse
In case anyone still has issue with key combo booting into cwm you must release volume up at vibrate on lg logo but keep holding the power and menu keys.
I guess I'll repeat it for the umpteenth time. You need to unlock the bootloader.
Sent from my LG-P769 using XDA Premium 4 mobile app
Hi people.
I have new bricked Huawei Honor 4c with HiSilicon Kirin 620 octacore (Hi6620) Hardly bricked.
I`ve unlocked bootloader and custom recovery used to flash it with my own update.zip from other phone (with LTE support). At the end of flashing - it turned off and bricked.
BUT! After connecting to PC via USB it flashes GREEN and RED leds a few times and after windows determines it as a device with USB\VID_12D1&PID_3609&REV_0000 and named as 䕇䕎䥎 ㌲㔴㜶㤸 .
It is Huawei`s VID. And after a lot of search I found a driver for it - and device became HUAWEI USB-COM 1.0. But nothing else.
No flash utility, nothing. HiSilicon-IDT for K3 processor doesn`t work.
After another searches I found very similar device - it`s named HiKey board. Based on Hisilicon Kirin processor too https://www.96boards.org/.
This board is base around the HiSilicon Kirin 6220 eight-core ARM Cortex-A53 64-bit SoC running at 1.2GHz and delivering over 10,000 Dhrystone VAX MIPS total performance. The SoC also delivers high performance 3D graphics support with its ARM Mali 450-MP4 GPU.
1GB 800MHz LPDDR3 DRAM, 4GB eMMC Flash Storage and the standard 96Boards microSD v3.0 socket provide high performance. Flexible storage options and connectivity are available through 802.11a/b/g/n WiFi, Bluetooth 4.0 LE, three high speed USB 2.0 ports (1 OTG), an HDMI 1.3 1080p video output with audio, and Maker, DSI display and CSI camera interfaces. The board is the standard 96Boards credit-card form factor powered by an 8-18V DC 2A power supply.
Click to expand...
Click to collapse
As we can see - it is very close to ours phone.
It is fully documented and has a lot of spec about proc and other.
And in it`s manual written about recovery procedure after damage of ROM - when device is powered on - it is in "download mode" for 90 seconds - abslolutly like mine phone - after 90 second it turns off from windows.
In short - it is ability to write 2 fastboot images (fastboot1.img and fastboot2.img) in RAM, launch them and using fastboot command flash images to eMMC. They use SERIAL COM PORT to manipulate with device.
It uses utility called "hisi-idt.py" - it is a python script for Linux based machines.
I`ve Installed Linux Mint and try it.
And I`ve some result - first image is going fine and I receive "Done"
But second image is always "Failed". And fastboot command "fastboot devices" do not list any devices.
Viewing binaries from my ROM (Fastboot.img and Fastboot1.img) in HEX - I can see load addresses to ROM are the same as in python script. It is 0xf9800800 and 0x0700000 for both images.
But.... have no success. It looks like I`m close to the goal.
Any ideas?
Noone intersted in?
I`ve found UART Rx Tx points on the motherboard and now I can get some debug info.
I see I can load images into RAM but...
Code:
debug EMMC boot: print init OK
debug EMMC boot: send RST_N .
debug EMMC boot: start eMMC boot......
OnChipRom: fastboot1 Verif sucess !
[BDID]boardid: 745 <7.4.5>
battery ocv is 4141 mv
�����������������������������������������������������壂�{��?O
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f��B�rreset device done.
start enum.
enum done intr
Enum is starting.
usb reset intr
enum done intr
NULL package
NULL package
USB ENUM OK.
init ser device done....
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
uFileAddress=ss=f9800800
start armboot download mode
[BDID]boardid: 745 <7.4.5>
battery 펟v���W�����ʝcn�g������
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f���gc姾����fB�ʔ
thats all for a while
i have same problem pleas tell me if you fix it
michfood said:
Noone intersted in?
I`ve found UART Rx Tx points on the motherboard and now I can get some debug info.
I see I can load images into RAM but...
Code:
debug EMMC boot: print init OK
debug EMMC boot: send RST_N .
debug EMMC boot: start eMMC boot......
OnChipRom: fastboot1 Verif sucess !
[BDID]boardid: 745 <7.4.5>
battery ocv is 4141 mv
�����������������������������������������������������壂�{��?O
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f��B�rreset device done.
start enum.
enum done intr
Enum is starting.
usb reset intr
enum done intr
NULL package
NULL package
USB ENUM OK.
init ser device done....
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
uFileAddress=ss=f9800800
start armboot download mode
[BDID]boardid: 745 <7.4.5>
battery 펟v���W�����ʝcn�g������
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f���gc姾����fB�ʔ
thats all for a while
Click to expand...
Click to collapse
Hello, can you uload somewere the python file to have a look at it? Also the log you have provided to us it's the whole log?
no the log is not full.
it changes UART speed while booting.
script:
Code:
#!/usr/bin/python
#-*- coding: utf-8 -*-
import os
import os.path
import serial, time
import array
import sys, getopt
class bootdownload(object):
'''
Hisilicon boot downloader
>>> downloader = bootdownload()
>>> downloader.download(filename)
'''
# crctab calculated by Mark G. Mendel, Network Systems Corporation
crctable = [
0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,
0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,
0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de,
0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,
0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4,
0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc,
0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b,
0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12,
0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41,
0xedae, 0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49,
0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78,
0x9188, 0x81a9, 0xb1ca, 0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f,
0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e,
0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235, 0x5214, 0x6277, 0x7256,
0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,
0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d, 0xd73c,
0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab,
0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3,
0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92,
0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9,
0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,
0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0,
]
startframe = {
'hi3716cv200':[0xFE,0x00,0xFF,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x02,0x01]
}
headframe = {
'hi3716cv200':[0xFE,0x00,0xFF,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x02,0x01]
}
bootheadaddress = {
'hi3716cv200':0xF9800800
}
bootdownloadaddress = {
'hi3716cv200':0x07000000
}
BOOT_HEAD_LEN = 0x4F00
MAX_DATA_LEN = 0x400
def __init__(self,chiptype,serialport):
try:
self.s = serial.Serial(port=serialport, baudrate=115200, timeout=1)
except serial.serialutil.SerialException:
#no serial connection
self.s = None
print "\nFailed to open serial!", serialport
sys.exit(2)
self.chip = chiptype
def __del__(self):
if self.s != None:
self.s.close()
def calc_crc(self, data, crc=0):
for char in data:
crc = ((crc << 8) | ord(char)) ^ self.crctable[(crc >> 8) & 0xff]
for i in range(0,2):
crc = ((crc << 8) | 0) ^ self.crctable[(crc >> 8) & 0xff]
return crc & 0xffff
def getsize(self, filename):
st = os.stat(filename)
return st.st_size
def sendframe(self, data, loop):
for i in range(1, loop):
self.s.flushOutput()
self.s.write(data)
self.s.flushInput()
try:
ack = self.s.read()
if len(ack) == 1:
if ack == chr(0xaa):
return None
except:
return None
print 'failed'
def sendstartframe(self):
self.s.setTimeout(0.01)
data = array.array('B', self.startframe[self.chip]).tostring()
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,10000)
def sendheadframe(self,length,address):
self.s.setTimeout(0.03)
self.headframe[self.chip][4] = (length>>24)&0xff
self.headframe[self.chip][5] = (length>>16)&0xff
self.headframe[self.chip][6] = (length>>8)&0xff
self.headframe[self.chip][7] = (length)&0xff
self.headframe[self.chip][8] = (address>>24)&0xff
self.headframe[self.chip][9] = (address>>16)&0xff
self.headframe[self.chip][10] = (address>>8)&0xff
self.headframe[self.chip][11] = (address)&0xff
data = array.array('B', self.headframe[self.chip]).tostring()
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,16)
def senddataframe(self,seq,data):
self.s.setTimeout(0.15)
head = chr(0xDA)
head += chr(seq&0xFF)
head += chr((~seq)&0xFF)
data = head + data
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,32)
def sendtailframe(self,seq):
data = chr(0xED)
data += chr(seq&0xFF)
data += chr((~seq)&0xFF)
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,16)
def senddata(self, data, address):
length=len(data)
self.sendheadframe(length,address)
seq=1
while length > self.MAX_DATA_LEN:
self.senddataframe(seq,data[(seq-1)*self.MAX_DATA_LEN:seq*self.MAX_DATA_LEN])
seq = seq+1
length = length-self.MAX_DATA_LEN
self.senddataframe(seq,data[(seq-1)*self.MAX_DATA_LEN:])
self.sendtailframe(seq+1)
def download(self, filename1, filename2):
f=open(filename1,"rb")
data = f.read()
f.close()
print 'Sending', filename1, '...'
self.senddata(data,self.bootheadaddress[self.chip])
print 'Done\n'
if filename2:
f=open(filename2,"rb")
data = f.read()
f.close()
print 'Sending', filename2, '...'
self.senddata(data,self.bootdownloadaddress[self.chip])
print 'Done\n'
def burnboot(chiptype, serialport, filename1, filename2=''):
downloader = bootdownload(chiptype, serialport)
downloader.download(filename1, filename2)
def startterm(serialport=0):
try:
miniterm = Miniterm(
serialport,
115200,
'N',
rtscts=False,
xonxoff=False,
echo=False,
convert_outgoing=2,
repr_mode=0,
)
except serial.SerialException, e:
sys.stderr.write("could not open port %r: %s\n" % (port, e))
sys.exit(1)
miniterm.start()
miniterm.join(True)
miniterm.join()
def main(argv):
'''
img2 = 'fastboot2.img'
'''
img1 = 'fastboot1.img'
img2 = ''
dev = '/dev/serial/by-id/usb-䕇䕎䥎_㌲㔴㜶㤸-if00-port0'
try:
opts, args = getopt.getopt(argv,"hd:",["img1=","img2="])
except getopt.GetoptError:
print 'hisi-idt.py -d device --img1 <fastboot1> --img2 <fastboot2>'
sys.exit(2)
for opt, arg in opts:
if opt == '-h':
print 'hisi-idt.py -d device --img1 <fastboot1> --img2 <fastboot2>'
sys.exit()
elif opt in ("-d"):
dev = arg
elif opt in ("--img1"):
img1 = arg
elif opt in ("--img2"):
img2 = arg
print '+----------------------+'
print ' Serial: ', dev
print ' Image1: ', img1
print ' Image2: ', img2
print '+----------------------+\n'
if not os.path.isfile(img1):
print "Image don't exists:", img1
sys.exit(1)
if (img2):
if not os.path.isfile(img2):
print "Image don't exists:", img2
sys.exit(1)
burnboot('hi3716cv200', dev, img1, img2)
if __name__ == "__main__":
main(sys.argv[1:])
logs:
Code:
��������������������������������������������������������������������������������������������������������������������������0
===>vbus_is_high!
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000cb0, hpm_dly_exit = 0x00000cf6!
prof[960000]: hpm_dly_exp = 0x00000cb6, hpm_dly_exit = 0x00000cfc!
prof[1200000]: hpm_dly_exp = 0x00000e94, hpm_dly_exit = 0x00000eda!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: no valid data in buffer , (sig = 0x43474244)
[emmc_set_card_ready]emmc id:0xb64432c9 0x520644c1 0x474e4433 0x15010038
[emmc_set_card_ready]manufid: 0x00000015
DDR mode emmc
--error: gps/ldo16
[SEC]check_oem_hw: carrier_id = 0x00000000
DX_BIV_SwImageVerification image id is 0x00000011, return is 0xf1000002 !
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
Load fastboot2 failed!
hw_error_print : led = 12. func = 0. err = 0.
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
enter fatal_exception!
Unrecovery Error, go to onchiprom usbloader!
USB Soft Disconnect
��������������������������������������������������������������������������������������������������������������������������0
===>vbus_is_high!
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000caf, hpm_dly_exit = 0x00000cf5!
prof[960000]: hpm_dly_exp = 0x00000cb5, hpm_dly_exit = 0x00000cfb!
prof[1200000]: hpm_dly_exp = 0x00000e90, hpm_dly_exit = 0x00000ed6!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: no valid data in buffer , (sig = 0x43474244)
[emmc_set_card_ready]emmc id:0xb64432c9 0x520644c1 0x474e4433 0x15010038
[emmc_set_card_ready]manufid: 0x00000015
DDR mode emmc
--error: gps/ldo16
[SEC]check_oem_hw: carrier_id = 0x00000000
DX_BIV_SwImageVerification image id is 0x00000011, return is 0xf1000002 !
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
Load fastboot2 failed!
hw_error_print : led = 12. func = 0. err = 0.
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
enter fatal_exception!
Unrecovery Error, go to onchiprom usbloader!
USB Soft Disconnect
��������������������������������������������������������������������������������������������������������������������������́v
nUpdate debug uart baudRate to :921600
===>vbus_is_high!
fastboot1 download_mode:1
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000cad, hpm_dly_exit = 0x00000cf3!
prof[960000]: hpm_dly_exp = 0x00000cad, hpm_dly_exit = 0x00000cf3!
prof[1200000]: hpm_dly_exp = 0x00000e88, hpm_dly_exit = 0x00000ece!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: found existing buffer, size 1044, addr 24
USB_DOWNLOAD_MODE
timestamp: 0xfff2c982
return from fastboot1!
uFileAddress=ss=07000000
uFileAddress=ss=07000000
uFileAddress=ss=07000000
image verify failed!
@michfood hmm okay i had a look. As i can understand your phone doesn't accept the second fastboot.img. I don't think that the problem is the crctable. Maybe you have a wrong fastboot.img?? Try to get a new dump from an another phone.
If your image it's an original dump then there is no reason why it fails to pass the check. The reason why i think the crc signature it's correct it is because you are able to download both images(i saw more details in 96boards forum).
the second image do not start.
after loading first - it says:
"timestamp: 0xfff2c982
return from fastboot1!
uFileAddress=ss=07000000
image verify failed!"
so it is returned from fastboot1 to onchip loader and tries to load second image - but fails.
have no possibility to look normal boot as all phones are under guaranty - nobody want to solder uart pins
Actually i didn't said to you to look at a normal boot uart log. In a normal boot you'll just see the kernel booting. Maybe you second fastboot.img is faulty...
the second boot is correct - from the update.app, as the first one
there is a thought that message "image verify failed" is an onchip loader message after fastboot2 loads, runs, made some checks of other partitions (broken) (with no UART messages) and exits with some error code.
here we can see difference between boot from eMMC (left) and boot from RAM (right)
http://clip2net.com/s/3mFVeRi
No, i think fastboot2 doesn't boot at all. Look at ths:
Code:
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
If you try to load only one fastboot.img? what happens?
you just look at log booting from emmc. while booting from ram - no such message.
and once more - after loading first fastboot to RAM it exits with message "return from fastboot1" and tries to load second file to RAM. read carefully
I've got a honor 4x which uses the same chipset. Mine is also bricked but loads into Fastboot&rescue mode, which does not allow me to update the fastboot image due to a signature verify problem (BL31 image). This is related to ARM Trusted Firmware. Also, it does not load a new update.app from the SDCARD - Simply hangs on the logo screen. Therefore, I need to force it to flash a new fastboot.img. I read the HiKey user guide, and noticed there's a J15 SEL jumper, where, when closed, will attempt to program the flash from USB OTG source. Before a pull my phone apart, I would like to know whether anybody has tried flashing a new fastboot.img via USB OTG via closing the J15 SEL jumper and whether it worked. Or if there's any other way to boot my own fastboot.img
some info. i`m looking for motherboard on ali.. have no success
Same problem
michfood said:
Hi people.
I have new bricked Huawei Honor 4c with HiSilicon Kirin 620 octacore (Hi6620) Hardly bricked.
I`ve unlocked bootloader and custom recovery used to flash it with my own update.zip from other phone (with LTE support). At the end of flashing - it turned off and bricked.
BUT! After connecting to PC via USB it flashes GREEN and RED leds a few times and after windows determines it as a device with USB\VID_12D1&PID_3609&REV_0000 and named as 䕇䕎䥎 ㌲㔴㜶㤸 .
It is Huawei`s VID. And after a lot of search I found a driver for it - and device became HUAWEI USB-COM 1.0. But nothing else.
No flash utility, nothing. HiSilicon-IDT for K3 processor doesn`t work.
After another searches I found very similar device - it`s named HiKey board. Based on Hisilicon Kirin processor too https://www.96boards.org/.
As we can see - it is very close to ours phone.
It is fully documented and has a lot of spec about proc and other.
And in it`s manual written about recovery procedure after damage of ROM - when device is powered on - it is in "download mode" for 90 seconds - abslolutly like mine phone - after 90 second it turns off from windows.
In short - it is ability to write 2 fastboot images (fastboot1.img and fastboot2.img) in RAM, launch them and using fastboot command flash images to eMMC. They use SERIAL COM PORT to manipulate with device.
It uses utility called "hisi-idt.py" - it is a python script for Linux based machines.
I`ve Installed Linux Mint and try it.
And I`ve some result - first image is going fine and I receive "Done"
But second image is always "Failed". And fastboot command "fastboot devices" do not list any devices.
Viewing binaries from my ROM (Fastboot.img and Fastboot1.img) in HEX - I can see load addresses to ROM are the same as in python script. It is 0xf9800800 and 0x0700000 for both images.
But.... have no success. It looks like I`m close to the goal.
Any ideas?
Click to expand...
Click to collapse
Hi,
I'm stucked in the same hard brick. Could you provide a download link for the driver you found?
Are there news about progresses with this issue?
Thank you very much, I'll try to help if you want
In China,Hisilicon Kirin 620 is hi6210,not 6620.You can get the source code of HUAWEI Honor 4C from:http://emuirom123.dbankcloud.com/Cherrymini_kernel_[Android 5.1 EMUI3.1].tar.gz?rid=1520
It is for the China Mobile version(CHM-TL00H) with Kirin 620.
Chinese version Kirin 620 runs 8×A53 1.2GHz cores and ARM Mali-450 MP4 Gpu.The baseband of hisilicon kirin 620 is Balong V8R1SFT.
Sorry for my bad English.
来自搭载Android 2.3 GingerBread的华为Y220-T10
JackLenz said:
Hi,
I'm stucked in the same hard brick. Could you provide a download link for the driver you found?
Are there news about progresses with this issue?
Thank you very much, I'll try to help if you want
Click to expand...
Click to collapse
still nothing
zhaozihanzzh said:
In China,Hisilicon Kirin 620 is hi6210,not 6620.You can get the source code of HUAWEI Honor 4C from:http://emuirom123.dbankcloud.com/Cherrymini_kernel_[Android 5.1 EMUI3.1].tar.gz?rid=1520
It is for the China Mobile version(CHM-TL00H) with Kirin 620.
Chinese version Kirin 620 runs 8×A53 1.2GHz cores and ARM Mali-450 MP4 Gpu.The baseband of hisilicon kirin 620 is Balong V8R1SFT.
Sorry for my bad English.
来自搭载Android 2.3 GingerBread的华为Y220-T10
Click to expand...
Click to collapse
thanks for info - but how it helps?
michfood said:
still nothing
Click to expand...
Click to collapse
And what about the driver link?
I found some source code on github, maybe it could be useful
https://github.com/muhammadfahadbaig/android_vendor_huawei_hi6210sft
Hi.
Similar problem like here: http://forum.xda-developers.com/showthread.php?t=2334337
I am fighting with this phone two days.
In the first phase ( 18h ago) i connected by omap4boot and tried this - http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20
next i did all wipes, i tried by cwm install this rom - u2_v20o_signed_022314_123556.zip
I thought all is good, but ofc still was logo LG.
Anyone LG FLash tool didnt work (i will explain it with screens after, when will can run into S/W mode)
I tried this http://forum.xda-developers.com/showthread.php?t=2292828
and i had very weird error:
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
reading ASIC ID
usb_write 4
usb_read 81
[*] read 0 bytes
NumOfSubblocks: 0x5
Subblock ID: 0x1
Subblock Size: 0x5
CH enabled: 0x7
ROM revision: 0x4
Checksum Subblock: 0x15
CHIP: 4430
IDEN: b1a3cecb3e5a097ee4d9313e2070f8863ca117f3
MPKH: 5f4092eccddf90fa43f546adf89508b31b9c74795e9516194c0ea6412fdcb7f6
CRC0: 9c669ad9
CRC1: 682adccf
sending 2ndstage to target... f0030002
usb_write 4
usb_write 4
wait 5-lelelel...
[*] msg size = 4
usb_write 21552
[*] data size = 21552
usb_close
Reopen usb...
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
waiting for 2ndstage response...
usb_read 4
usb read = aabbccdd
accepted 2ndstage response
sending image to target...
size = 246272
usb_write 4
usb_write 246272
** Done **
< waiting for device >
sending 'x-loader' (384 KB)...
OKAY [ 0.204s]
writing 'x-loader'...
OKAY [ 2.845s]
finished. total time: 3.050s
sending 'u-boot' (1024 KB)...
FAILED (status read failed (Too many links))
finished. total time: 107.422s
Done
Click to expand...
Click to collapse
Then i tried all ideas, which came to my head.
(Relock bootloader http://forum.xda-developers.com/showthread.php?p=44580559
p760-twrp-2.6.1-recovery.img
and much other, which i didnt remember...)
Finaly phone is bricking.
Any advices?
Edit:
Yesterday battery had 4.01 V, today has 3.7. I will try charge tomorrow.
Guys, what when i-loaded u-boot, x-loader after like i flashed JB rom by CWM ?
It can explain my current situation?
Look:
It are partiton for JB
View attachment 3762143
It are partition for ICS
View attachment 3762144
So i should now load some loader and boot file from JB?
Can U help me, pls?
I downloaded ICS stock rom. Exctracted it.
I made x-loader from file 0-gpt1.img. (256LBA-1023LBA). It is exactly same what file p1ics760.bin from fastboot by Lelus http://forum.xda-developers.com/showthread.php?t=2292828 )
once again i tried:
fastboot flash x-loader
fastboot flash u-boot
fastboot flash boot
fastboot flash recovery
All files are original from ICS stock rom.
No result.....
works only fastboot mode by software fastboot by Lelus.
Srsly this topic is so boring?
Edit:
Hm... u-boot file from here http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20
is different from mine... x-loader is same like i wrote early...
It weird:
In Fastboot by Lelus - if i use any option between 2 and 7 - i get:
sending 'u-boot' (1024 KB)...
FAILED (status read failed (Too many links))
finished. total time: 107.422s
So i replaced file:
\fastboot\xu\p2ics760.bin
for original stock u-boot (in second try i replaced u-boot from this link http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20)
(original p2ics760.bin i renamed to p2ics760.bin.old and u-boot.img i renamed to p2ics760.bin
and still is error - Too many links
But when i use:
fastboot flash u-boot u-boot.img - it hasn't error. It is same file!
Maybe the operation is successful, but in real it doesen't change anything? Is it possible?
Groszexxx said:
It weird:
In Fastboot by Lelus - if i use any option between 2 and 7 - i get:
sending 'u-boot' (1024 KB)...
FAILED (status read failed (Too many links))
finished. total time: 107.422s
So i replaced file:
\fastboot\xu\p2ics760.bin
for original stock u-boot (in second try i replaced u-boot from this link http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20)
(original p2ics760.bin i renamed to p2ics760.bin.old and u-boot.img i renamed to p2ics760.bin
and still is error - Too many links
But when i use:
fastboot flash u-boot u-boot.img - it hasn't error. It is same file!
Maybe the operation is successful, but in real it doesen't change anything? Is it possible?
Click to expand...
Click to collapse
If you can enter in lelus fastboot, then flash a recovery wipe partitions and then with the recovery flash a rom....
My english is such bad or u didnt read the all posts? .
I flashed recovery partition much time. Telefon still is dead. Stock recovery, CWM, TWRP.
If I could flash recovery and after could "instal" rom - then it would not be problem .
Groszexxx said:
My english is such bad or u didnt read the all posts? .
I flashed recovery partition much time. Telefon still is dead. Stock recovery, CWM, TWRP.
If I could flash recovery and after could "instal" rom - then it would not be problem .
Click to expand...
Click to collapse
Then, If your L9 doesn't boot, it could be beacause a "IC power Cristal" or other hardware issue like EMM break (Eprom). In some case a box like http://octopusbox.com can solve the problem or in other case extract a log file with the exact issue details
A dead block of flash will produce CRC errors after or during the flash process and random lockups or reboots during operation. And if the fastboot problem strikes, you can issue commands via ADB, but after the necessary reboot there will be the PnP sound loop. If the phone is in Charge-only mode, ADB commands will be ignored, you can issue them, but **** happens.
Was there any positive feedback for the flash commands?
puntoazul said:
Then, If your L9 doesn't boot, it could be beacause a "IC power Cristal" or other hardware issue like EMM break (Eprom). In some case a box like http://octopusbox.com can solve the problem or in other case extract a log file with the exact issue details
Click to expand...
Click to collapse
It can be true. I received similar diagnosis about corrupt emmc. Anyway - for me it is possible but very unlikely (Ofc i havent experience).
lecorbusier said:
A dead block of flash will produce CRC errors after or during the flash process and random lockups or reboots during operation. And if the fastboot problem strikes, you can issue commands via ADB, but after the necessary reboot there will be the PnP sound loop. If the phone is in Charge-only mode, ADB commands will be ignored, you can issue them, but **** happens.
Was there any positive feedback for the flash commands?
Click to expand...
Click to collapse
Maybe i will show it on screens:
I run Fastboot by Lelus and set 2 option.
View attachment 3765116
And i get error:
View attachment 3765119
When i run fastboot by Lelus and set option 1 and type:
fastboot flash recovery 'filename'
View attachment 3765117
EHh, Finaly i think theory with emmc corrupt is are confirming.... after 30-40x flashed now i get one new and one very common error:
View attachment 3765322
View attachment 3765324
I am so sad! . But anyway, i am feeling much better when i know what is wrong with phone.
U-boot gets sent to the phone's RAM, but writing to its appropiate partition fails utterly. That is not necessarily hardware related. And nothing I've seen before. Either the partition got damaged or deleted, or it's in F2FS format. Artas' CM11 uses F2FS, EdwinMoqs CM13 as an option, and TWRP from 2.8.x can format partitions with F2FS.
But D/L mode is almost indestructible, only a bit tricky to invoke. And requires LG drivers. Even if the phone is no longer getting recognized by LG drivers and LG software because of a custom rom, when in D/L mode the LG driver should install a virtual COM port and the LG flash tool should now recognize the phone. Ihad difficulties flashing a KDZ file with LG Fladh Tool 2014,but the tool from the LG site, getting the stock rom directly from the server, works reliably, but it's best to flash twice in a row. If the phone auto-reboots into launcher, it's a success. If you see LG's stock recovery after the flash, flash another time.
Ok. if you run this command: "fastboot flash u-boot u-boot.img" (assuming that the u-boot.img file is for your l9 model), and result is cannot write in partition then EMMC is break (95% probability)
---------- Post added at 09:16 AM ---------- Previous post was at 09:13 AM ----------
lecorbusier said:
U-boot gets sent to the phone's RAM, but writing to its appropiate partition fails utterly. That is not necessarily hardware related. And nothing I've seen before. Either the partition got damaged or deleted, or it's in F2FS format. Artas' CM11 uses F2FS, EdwinMoqs CM13 as an option, and TWRP from 2.8.x can format partitions with F2FS.
But D/L mode is almost indestructible, only a bit tricky to invoke. And requires LG drivers. Even if the phone is no longer getting recognized by LG drivers and LG software because of a custom rom, when in D/L mode the LG driver should install a virtual COM port and the LG flash tool should now recognize the phone. Ihad difficulties flashing a KDZ file with LG Fladh Tool 2014,but the tool from the LG site, getting the stock rom directly from the server, works reliably, but it's best to flash twice in a row. If the phone auto-reboots into launcher, it's a success. If you see LG's stock recovery after the flash, flash another time.
Click to expand...
Click to collapse
Could be... perhaps if use Lg flash tool 2014 in emergency mode... (5% probability but is more than nothing) i hope @Groszexxx can revive his device
and if i was you... i try this... (see attach)
Yes, i talked about octoplus with someone, who has it. I never had anyone box . It is not my job . I was only curious what is it with phone my friend. I spend much hours on this issue. Anyway, i dont regret.
I will send phone to someone, who can flash it by some box like octoplus or jtag.
Thanks for lecorbusier post. I read much post, but this one is new for me.
So - time saying goodbye .
Maybe i will inform what will be next, maybe not ;p. We will see .
Thanks for all!